141–150 of 160 posts
I had a Pandora account long before they bowed to the music cartel and restricted access to anyone outside the US. I am now in an odd situation where I cannot login to change my password, or delete my account (not that I trust any delete account functions these days anyway). Is there anyone here working for Pandora that could help me?
I had a Pandora account long before they bowed to the music cartel and restricted access to anyone outside the US. I am now in an odd situation where I cannot login to change my password, or delete my account (not that I trust any delete account functions these days anyway). Is there anyone here working for Pandora that could help me?
From there you can say you have forgot your password: http://www.pandora.com/forgot.vm?target=
Completing this form sends a forgotten password email to your registered email address.
That link provided allows to you reset your password.
Earlier quoted context omitted.
I know why it is different on each system, it is because the numeric user ID is encoded in it. I am 99% sure I am right, all the fields/values are merely obfuscated with a constant key. Not proper encryption at all.
> I know why it is different on each system, it is because the numeric user ID is encoded in it. Yes, this is what I was saying. > I am 99% sure I am right, all the fields/values are merely obfuscated with a constant key. Not proper encryption at all. Okay, so if I tell you my key for the field is: bc673ea54a2b7153aaafbf178e9b0892e1f2e56be5aaa5a7, can you discern my key? I'm betting not. First, this is indeed obfusca…
Earlier quoted context omitted.
There appears to be a real security issue that every one missed in this thread: the password does not appear to be encrypted, but merely obfuscated , using the same obfuscation technique as the one used to obfuscate the randomly generated JSON attribute names. Which means that even after logging out of pandora, the password would remain in the HTML local storage, and could be de-obfuscated, and log back into pandora.…
Update 04:49 UTC: I am done reverse-engineering Pandora's javascript code! And I was right: the JSON object that it stores in the HTML local storage is merely obfuscated with static keys, not encrypted. I was able to decrypt the full object, including my Pandora password: lastUserId: "xxxxxxxxx" storedUserIds: ["xxxxxxxxx"] Uxxxxxxxxx.StationSortOrderAlpha: false Uxxxxxxxxx.isAnonymous: false Uxxxxxxxxx.Username: "xx…
Pandorhack: Stealing Pandora Passwords http://news.ycombinator.com/item?id=4553184
Earlier quoted context omitted.
I disagree from personal experience. On (a) if you receive an email confirming your registration that displays your password, I guess it could be hashed later but probably wasn't, right? And (b), this happened with my city's utility bill service (has a lot of my personal info) and an email to the mayor's office got it addressed. My larger point is that telling a non-technical higher-up can go a long way for things wh…
I agree that if you get the password in an e-mail plain text, there could be an issue... unless your e-mail client is rendering that section using a browser... which happens to have an encrypted version of the password stored locally. However, in Pandora's case, this isn't what is happening, and it appears they've taken pretty extensive security measures given their constraints. Telling a non-technical higher-up ther…
Earlier quoted context omitted.
Re #1: There's still a matter of degree, however - this takes zero technical knowledge and zero external tools, works on every platform that Pandora runs on, and requires maybe 5 seconds of time. Re #2: Again, it's a difference of degree. Invalid TLS certs will at least give a browser warning that a user isn't used to seeing (in modern browsers), cluing them in that something might be up. Sure, some users might bypas…
#1: You know what also requires zero technical knowledge and zero external tools and requires maybe 5 seconds of my time? Typing in a new password for the account and clicking "save". #2: It needn't be an invalid TLS cert. It could be a valid TLS cert pointing to another domain. The browser provides no warning and you only notice it if the check the domain is different from the one you expect. Watch out for domains t…
Earlier quoted context omitted.
Update 04:49 UTC: I am done reverse-engineering Pandora's javascript code! And I was right: the JSON object that it stores in the HTML local storage is merely obfuscated with static keys, not encrypted. I was able to decrypt the full object, including my Pandora password: lastUserId: "xxxxxxxxx" storedUserIds: ["xxxxxxxxx"] Uxxxxxxxxx.StationSortOrderAlpha: false Uxxxxxxxxx.isAnonymous: false Uxxxxxxxxx.Username: "xx…
Done: Pandorhack: Stealing Pandora Passwords http://news.ycombinator.com/item?id=4553184
Earlier quoted context omitted.
> The fact that someone could physically break into your machine to steal your Pandora password is extremely problematic? I'd hate to see your write-up once somebody knocks over the carton of milk... For users that use the same few passwords everywhere, it could well be a problem.
My reply to that argument here: http://hackerne.ws/item?id=4551852
Earlier quoted context omitted.
I know why it is different on each system, it is because the numeric user ID is encoded in it. I am 99% sure I am right, all the fields/values are merely obfuscated with a constant key. Not proper encryption at all.
> I know why it is different on each system, it is because the numeric user ID is encoded in it. Yes, this is what I was saying. > I am 99% sure I am right, all the fields/values are merely obfuscated with a constant key. Not proper encryption at all. Okay, so if I tell you my key for the field is: bc673ea54a2b7153aaafbf178e9b0892e1f2e56be5aaa5a7, can you discern my key? I'm betting not. First, this is indeed obfusca…
The state of typical security in software projects of the 1990's: sad, sad... Any improvement in 2012: such a piddling little improvement. The trend is clear as is the conclusion: the average dev can't be trusted to do security. It doesn't work!
Earlier quoted context omitted.
My reply to that argument here: http://hackerne.ws/item?id=4551852
Blame the user is a bankrupt strategy. Maybe you can deflect the blame, but it does nothing to keep the black hats at bay. In essence, you are admitting you are wrong. (Clearly passwords period are broken for use by non geeks, but that is another can of worms.)
All this shit started because someone who does not understand security thought it was horrible that a local program might store a password locally in plain text. There are a billion local programs that store passwords in a reversible way. Know why? Because sending a non-mac password is the same if it's hashed or not.
Blame whoever you want to blame, I don't care. But don't tell me Pandora is responsible for the total security of every moron on the internet, either.